diff --git a/.gitignore b/.gitignore
index 0e78cf9..45d5e0e 100755
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
hardware-configuration.nix
.vscode/
+matrix-user-tokens.txt
+nixpkgs/
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..10f6a29
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,95 @@
+{
+ "nodes": {
+ "botcore-v4": {
+ "inputs": {
+ "nixpkgs": "nixpkgs"
+ },
+ "locked": {
+ "lastModified": 1683656302,
+ "narHash": "sha256-I2eu+9/i0ktqNzQwkc0NuczQ2UThCBf8L9xnZ8v3NSM=",
+ "owner": "BotCore-Devs",
+ "repo": "BotCore-v4",
+ "rev": "0e8738ba7df060782df050dc733b0bfc8c499830",
+ "type": "gitlab"
+ },
+ "original": {
+ "owner": "BotCore-Devs",
+ "ref": "staging",
+ "repo": "BotCore-v4",
+ "type": "gitlab"
+ }
+ },
+ "home-manager": {
+ "inputs": {
+ "nixpkgs": "nixpkgs_2"
+ },
+ "locked": {
+ "lastModified": 1690982105,
+ "narHash": "sha256-32AzoLuwhtxBItcULRiCnxRfJcbVXbPZSH9TDVg21mU=",
+ "owner": "nix-community",
+ "repo": "home-manager",
+ "rev": "b2ac1d2c32ac11b8d231d23622cdc4b2f28d07d2",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nix-community",
+ "ref": "master",
+ "repo": "home-manager",
+ "type": "github"
+ }
+ },
+ "nixpkgs": {
+ "locked": {
+ "lastModified": 1683408522,
+ "narHash": "sha256-9kcPh6Uxo17a3kK3XCHhcWiV1Yu1kYj22RHiymUhMkU=",
+ "owner": "nixos",
+ "repo": "nixpkgs",
+ "rev": "897876e4c484f1e8f92009fd11b7d988a121a4e7",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nixos",
+ "ref": "nixos-unstable",
+ "repo": "nixpkgs",
+ "type": "github"
+ }
+ },
+ "nixpkgs_2": {
+ "locked": {
+ "lastModified": 1690881714,
+ "narHash": "sha256-h/nXluEqdiQHs1oSgkOOWF+j8gcJMWhwnZ9PFabN6q0=",
+ "owner": "NixOS",
+ "repo": "nixpkgs",
+ "rev": "9e1960bc196baf6881340d53dccb203a951745a2",
+ "type": "github"
+ },
+ "original": {
+ "owner": "NixOS",
+ "ref": "nixos-unstable",
+ "repo": "nixpkgs",
+ "type": "github"
+ }
+ },
+ "nixpkgs_3": {
+ "locked": {
+ "lastModified": 0,
+ "narHash": "sha256-MwJDlUWc8vybt5IAnCYzB0L/NoZLIWDYQ+9cn+MEECU=",
+ "path": "/Rory-Open-Architecture/nixpkgs",
+ "type": "path"
+ },
+ "original": {
+ "path": "/Rory-Open-Architecture/nixpkgs",
+ "type": "path"
+ }
+ },
+ "root": {
+ "inputs": {
+ "botcore-v4": "botcore-v4",
+ "home-manager": "home-manager",
+ "nixpkgs": "nixpkgs_3"
+ }
+ }
+ },
+ "root": "root",
+ "version": 7
+}
diff --git a/host/Rory-nginx/configuration.nix b/host/Rory-nginx/configuration.nix
index c38a1bf..2f2f7cc 100755
--- a/host/Rory-nginx/configuration.nix
+++ b/host/Rory-nginx/configuration.nix
@@ -4,9 +4,11 @@
imports =
[
../../modules/base-server.nix
+ ../../modules/users/levi.nix
+ ../../modules/users/db2k.nix
./software.nix
];
-
+ users.groups.ocp = {};
networking = {
hostName = "Rory-nginx";
interfaces.ens18.ipv4.addresses = [ {
diff --git a/host/Rory-nginx/hosts/rory.gay/matrix.nix b/host/Rory-nginx/hosts/rory.gay/matrix.nix
index 60a8e2c..46514a2 100755
--- a/host/Rory-nginx/hosts/rory.gay/matrix.nix
+++ b/host/Rory-nginx/hosts/rory.gay/matrix.nix
@@ -25,6 +25,11 @@
# https://matrix-org.github.io/synapse/latest/workers.html#synapseappgeneric_worker
locations."~ ^/_matrix/client/(r0|v3)/sync$" = {
proxyPass = "http://generic_workers_upstream$request_uri";
+ extraConfig = ''
+ proxy_read_timeout 300;
+ proxy_connect_timeout 300;
+ proxy_send_timeout 300;
+ '';
};
locations."~ ^/_matrix/client/(api/v1|r0|v3)/events$" = {
proxyPass = "http://generic_workers_upstream$request_uri";
diff --git a/host/Rory-nginx/hosts/thearcanebrony.net/root.nix b/host/Rory-nginx/hosts/thearcanebrony.net/root.nix
index 722e989..bd23f10 100755
--- a/host/Rory-nginx/hosts/thearcanebrony.net/root.nix
+++ b/host/Rory-nginx/hosts/thearcanebrony.net/root.nix
@@ -2,9 +2,11 @@
enableACME = true;
addSSL = true;
root = "/data/nginx/html_thearcanebrony";
+ extraConfig = ''
+ autoindex on;'';
locations = {
"/" = {
- index = "index.html";
+ #index = "index.html";
};
"/destroy" = {
return = "301 https://gitlab.com/KinoshitaProductions/SecureDestroyer/-/raw/master/run";
@@ -35,4 +37,4 @@
}';
'';
};
-}
\ No newline at end of file
+}
diff --git a/host/Rory-nginx/post-rebuild.sh b/host/Rory-nginx/post-rebuild.sh
new file mode 100755
index 0000000..ea6e013
--- /dev/null
+++ b/host/Rory-nginx/post-rebuild.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix coreutils jq openssl
+#set -x
+REG_KEY=`cat /var/lib/matrix-synapse/registration_shared_secret.txt`
+LOCALPART='rory.gay'
+REACHABLE_DOMAIN='http://localhost:8008'
+
+# -- LICENSE: CNPL v7+ - https://thufie.lain.haus/files/CNPLv7.md
+# Modified from Nyaaori (https://nyaaori.cat) <+@nyaaori.cat>
+# Explicit authorisation to use the code has been granted by the original author
+# for use by members of the Rory system (https://rory.gay)
+
+
+# the magic function:
+register(){
+ echo "Registering $1"
+ _nonce=`curl -s http://localhost:8008/_synapse/admin/v1/register | jq -r .nonce`
+ #data: nonce, domain, username, password
+ _hmac=`printf '%s\0%s\0%s\0%s' "$_nonce" "$1" "$2" "admin" | openssl dgst -sha1 -hmac "$REG_KEY" | awk '{print $2}'`
+ curl -s -XPOST -d '{"nonce": "'"$_nonce"'", "username": "'"$1"'", "displayname": "'"$1"'", "password": "'"$2"'", "admin": true, "mac": "'"$_hmac"'"}' $REACHABLE_DOMAIN/_synapse/admin/v1/register | tee -a matrix-user-tokens.txt
+ echo
+}
+
+# -- END OF LICENSED CODE
+
+
+
+PASSWD=`cat /etc/matrix-user-pass`
+for u in {draupnir,Alicia,Emma,Rory,root,Quetzelle}
+do
+ register $u $PASSWD
+done
diff --git a/host/Rory-nginx/software.nix b/host/Rory-nginx/software.nix
index 6423c08..56b09f4 100755
--- a/host/Rory-nginx/software.nix
+++ b/host/Rory-nginx/software.nix
@@ -27,6 +27,7 @@
'';
appendHttpConfig = ''
#sendfile on;
+ disable_symlinks off;
'';
upstreams = import ./matrix/upstreams.nix;
additionalModules = with pkgs.nginxModules; [
diff --git a/host/Rory-synapse/software.nix b/host/Rory-synapse/software.nix
index ea24c91..5db557b 100755
--- a/host/Rory-synapse/software.nix
+++ b/host/Rory-synapse/software.nix
@@ -93,11 +93,11 @@
allow_device_name_lookup_over_federation = true;
federation = {
- client_timeout = "10s";
- max_short_retries = 3;
- max_short_retry_delay = "30s";
+ client_timeout = "60s";
+ max_short_retries = 6;
+ max_short_retry_delay = "10s";
max_long_retries = 5;
- max_long_retry_delay = "5m";
+ max_long_retry_delay = "30s";
};
event_cache_size = "30K"; #defaults to 10K
@@ -114,7 +114,7 @@
# Alicia - figure this out later...
#registration_shared_secret = builtins.exec ["cat" "/dev/urandom" "|" "tr" "-dc" "a-zA-Z0-9" "|" "fold" "-w" "256" "|" "head" "-n" "1"];
- #registration_shared_secret_path = "/var/lib/matrix-synapse/registration_shared_secret.txt";
+ registration_shared_secret_path = "/var/lib/matrix-synapse/registration_shared_secret.txt";
listeners = [
{
@@ -145,7 +145,7 @@
host = "127.0.0.1";
application_name = "matrix-synapse (rory.gay)";
cp_min = 5;
- cp_max = 15;
+ cp_max = 50;
#cp_reconnect_interval = "True";
};
};
diff --git a/modules/base-server.nix b/modules/base-server.nix
index d577306..76f5947 100755
--- a/modules/base-server.nix
+++ b/modules/base-server.nix
@@ -7,6 +7,56 @@
./users/chris.nix
];
documentation.nixos.enable = false;
+ documentation.enable = false;
+ documentation.info.enable = false;
+ documentation.man.enable = false;
+
+
+ environment.variables.BROWSER = "echo";
+
+ nix.settings.trusted-users = [ "root" "@wheel" ];
+
+ time.timeZone = lib.mkDefault "UTC";
+ systemd = {
+ # Given that our systems are headless, emergency mode is useless.
+ # We prefer the system to attempt to continue booting so
+ # that we can hopefully still access it remotely.
+ enableEmergencyMode = false;
+
+ # For more detail, see:
+ # https://0pointer.de/blog/projects/watchdog.html
+ watchdog = {
+ # systemd will send a signal to the hardware watchdog at half
+ # the interval defined here, so every 10s.
+ # If the hardware watchdog does not get a signal for 20s,
+ # it will forcefully reboot the system.
+ runtimeTime = "20s";
+ # Forcefully reboot if the final stage of the reboot
+ # hangs without progress for more than 30s.
+ # For more info, see:
+ # https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdShutdownWatchdog
+ rebootTime = "30s";
+ };
+
+ sleep.extraConfig = ''
+ AllowSuspend=no
+ AllowHibernation=no
+ '';
+ };
+
+ systemd.services.NetworkManager-wait-online.enable = false;
+ systemd.network.wait-online.enable = false;
+ systemd.services.systemd-networkd.stopIfChanged = false;
+ systemd.services.systemd-resolved.stopIfChanged = false;
+ nix.settings.max-free = lib.mkDefault (1000 * 1000 * 1000);
+ nix.settings.min-free = lib.mkDefault (128 * 1000 * 1000);
+
+ # TODO: cargo culted.
+ nix.daemonCPUSchedPolicy = lib.mkDefault "batch";
+ nix.daemonIOSchedClass = lib.mkDefault "idle";
+ nix.daemonIOSchedPriority = lib.mkDefault 7;
+
+
# My servers always use /dev/sda as boot disk...
boot = {
kernelPackages = pkgs.linuxPackages_latest;
@@ -26,6 +76,7 @@
networking = {
hostName = lib.mkDefault "Rory-nix-base-server";
networkmanager.enable = false;
+ useNetworkd = true;
wireless.enable = false;
enableIPv6 = false;
firewall = {
@@ -35,7 +86,8 @@
};
useDHCP = false;
- nameservers = [ "1.1.1.1" ];
+# nameservers = [ "1.1.1.1" "1.0.0.1" "8.8.8.8" "8.4.4.8" ];
+ nameservers = [ "10.10.0.4" "10.10.0.5" ];
defaultGateway = "192.168.1.1";
};
diff --git a/modules/base.nix b/modules/base.nix
index b0e1d95..ffc08f9 100755
--- a/modules/base.nix
+++ b/modules/base.nix
@@ -6,7 +6,12 @@
./packages/vim.nix
./users/Rory.nix
];
- boot.kernelParams = [ "memory_hotplug.memmap_on_memory=1" "memhp_default_state=online" ];
+ boot.kernelParams = [
+ "memory_hotplug.memmap_on_memory=1"
+ "memhp_default_state=online"
+ "net.core.default_qdisc=fq"
+ "net.ipv4.tcp_congestion_control=bbr"
+ ];
networking = {
hostName = lib.mkDefault "Rory-nix-base";
firewall = {
@@ -29,8 +34,13 @@
};
};
- sound.enable = lib.mkDefault true;
- hardware.pulseaudio.enable = lib.mkDefault true;
+
+ systemd = {
+ sleep.extraConfig = ''
+ AllowSuspend=no
+ AllowHibernation=no
+ '';
+ };
environment.systemPackages = with pkgs; [
wget
@@ -47,12 +57,26 @@
neovim
# vimPlugins.vim-nix
tmux
+ jq
+ yq
+ pv
+ dig
+ cloud-utils
];
systemd.coredump.extraConfig = lib.mkDefault ''
Storage=none
'';
-
+ nix.settings.trusted-substituters = [
+ "https://nix-community.cachix.org"
+ "https://cache.garnix.io"
+ "https://numtide.cachix.org"
+ ];
+ nix.settings.trusted-public-keys = [
+ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+ "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+ "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE="
+ ];
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nixpkgs.config.allowUnfree = true;
security.sudo.wheelNeedsPassword = false;
diff --git a/modules/users/Rory.nix b/modules/users/Rory.nix
index 3079f7b..b9c5722 100755
--- a/modules/users/Rory.nix
+++ b/modules/users/Rory.nix
@@ -13,6 +13,7 @@
#"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICT+53Hy3wbIlNVIomK2RroaimMWrTlUkndjHt1dFuyh root@pfSense-arcane-home.localdomain"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILF2IuNu//0DP/wKMuDvBgVT3YBS2uULsipbdrhJCTM7 thearcanebrony@tab-linux-desktop"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN/kNkY/E5b6rvCQLMaSbpLQ/xoyywIwVVu9uo2j/B6p Rory@RoryNix"
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNhsYWo5pEilXQGcn2SOuvzIdy67QpdtC7vnmlJB9WX Administrator@nt-6mnnvobcjimo"
];
};
diff --git a/modules/users/db2k.nix b/modules/users/db2k.nix
new file mode 100755
index 0000000..a6dc7cd
--- /dev/null
+++ b/modules/users/db2k.nix
@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+
+{
+ users.groups.db2k = {};
+ users.users.db2k = {
+ isSystemUser = true;
+ extraGroups = [ "ocp" ];
+ group = "db2k";
+ home = "/data/nginx/html_git/.ocp";
+ shell = "${pkgs.git}/bin/git-shell";
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMfXA4Oh0LZqY8LAS/lnANKVDBlemHGPWdtep1GE/LId garyzipperer09@gmail.com"
+ ];
+ };
+}
+
diff --git a/modules/users/levi.nix b/modules/users/levi.nix
new file mode 100755
index 0000000..bb28656
--- /dev/null
+++ b/modules/users/levi.nix
@@ -0,0 +1,18 @@
+{ config, pkgs, ... }:
+
+{
+ users.groups.levi = {};
+ users.users.levi = {
+ isSystemUser = true;
+ extraGroups = [ "ocp" ];
+ group = "levi";
+ home = "/data/nginx/html_git/.ocp";
+ shell = "${pkgs.git}/bin/git-shell";
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN/DfjjvYlNVRSwuhxYq3MkUNQch5UJ4ktpDAAAYUTVa"
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC5c7dxZ3eOYxNo4pB5c/EdtR5E8RSqG4jJEjrIvVPws0Ab2zJ9tyzDmLMuUZqUWljbj/fVQhXRWuL92NtQUYnhwhdTC+hCf+hxWXahX6KU+mMUtlaLGD3BGGWKM6NO9uJq0wGIKemCX8dXfCSgVewV2Y6WBHnu5JLrnemStEMy67AT8uffVAgPiIKoIWhKxkSVqiWWQNhX/TPq1aOl+7igH9bV7Zc3eu1ST7SnNuR+Ma4OxDZUMV66Ovl5543vmNBbiTpRgs7nsOWTPT3oIMRL9bIMjwXh5GA0qUA1jXx+QFMyqsaReco9RtcM7tSp2KxP+ekYjWWthaa1JVzeuLFuR90NqASpUyXyWfZmwAZlimralBkWGx2fxviOu80h9HPUjYQEzoYBokSQVx/6H6O/na6IASw0GUTmQWINVhuFEcRJDXRs5nXPnZXp5aKgZjBDgK7T4U3M1fGdv/94oWPZG+BqcuM/JHeNGnqaitCobRXDprB0TTVefDsj+E0uJV8= levijordan007@gmail.com"
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILF2IuNu//0DP/wKMuDvBgVT3YBS2uULsipbdrhJCTM7 thearcanebrony@tab-linux-desktop"
+ ];
+ };
+}
+
|
